Avoid yaml.load, and prefer yaml.safe_load

[alex]

yaml.load ought to be named yaml.danger_load: it can execute arbitrary code (http://pyyaml.org/wiki/PyYAMLDocumentation#LoadingYAML)

[oliverchang]

We can consider these yaml files to be trusted, but I suppose this doesn't hurt.

[alex]

Writing some extended words on why I think this is important, even though they are, as you note, trusted in this case:

1. Users change, some day this might morph into something more self-service, and there's no guarantee anyone will remember in the future.
2. This trains readers and authors to remember to use the safer API in other contexts
3. Principle of least privilege: the privilege of executing arbitrary code from a configuration file is not necessary to the authors function

Cheers!